Handle app deployment guardrail suggestions

workplans/ADHOC-2026-06-15.md

@@ -0,0 +1,51 @@
+---
+id: ADHOC-2026-06-15
+type: workplan
+title: "Ad hoc Railiance app inbox suggestions"
+domain: railiance
+repo: railiance-apps
+status: finished
+owner: codex
+topic_slug: railiance
+created: "2026-06-15"
+updated: "2026-06-15"
+---
+
+# ADHOC-2026-06-15 - Ad hoc Railiance app inbox suggestions
+
+## Apply reuse-surface production guardrails
+
+```task
+id: ADHOC-2026-06-15-T01
+status: done
+priority: high
+```
+
+Added Railiance01 kubeconfig guardrails to the reuse-surface Makefile targets,
+documented the production kubeconfig restore path, added `make reuse-smoke`,
+and corrected stale `RAILIANCE-WP-0007` host/TLS notes to `92.205.62.239`.
+
+## Document inter-hub rollout verification
+
+```task
+id: ADHOC-2026-06-15-T02
+status: done
+priority: high
+```
+
+Added Makefile support for `INTER_HUB_IMAGE_TAG=<sha>` deploy overrides, aligned
+server dry-run handling, and documented the release inspection, migration
+boundary, immutable legacy selector guardrail, and v2 API smoke gate in
+`docs/inter-hub-on-railiance01.md`. The production deploy target now requires an
+explicit image tag to avoid silently deploying a stale checked-in value.
+
+## Adopt State Hub task status canon
+
+```task
+id: ADHOC-2026-06-15-T03
+status: done
+priority: medium
+```
+
+Updated `AGENTS.md` task status examples from the legacy aliases to the
+canonical `wait`, `todo`, `progress`, `done`, and `cancel` values.

workplans/RAILIANCE-WP-0007-reuse-surface-hub-on-railiance01.md

@@ -16,7 +16,7 @@ state_hub_workstream_id: "7da18dd8-76b9-4a70-b9d7-de541afc65c0"
 
 Companion to **`reuse-surface` REUSE-WP-0011**. Own the S5 Helm release,
 ingress, and operator targets for the federation service on production cluster
-node `railiance01` (`92.205.130.254`).
+node `railiance01` (`92.205.62.239`).
 
 ## Goal
 
@@ -109,7 +109,7 @@ state_hub_task_id: "14049fd1-3319-4a76-8b48-c4228a7939f7"
 ```
 
 Helm revision 3 (image `cb7a6e4`). Pod Running; `/health` and `/v1/federated`
-verified. TLS pending DNS A → `92.205.130.254`.
+verified. TLS Ready after DNS A → `92.205.62.239`.
 
 ## Post-Deploy Verification And Runbook
 
@@ -122,4 +122,4 @@ state_hub_task_id: "30b08789-4eb7-4182-87d1-8e464fc968d1"
 
 Runbook `docs/reuse-surface-on-railiance01.md` updated with deploy evidence,
 token retrieval, and TLS/DNS operator note. Smoke checks pass via ingress
-resolve; public TLS awaits DNS A → `92.205.130.254`.
+and public TLS on DNS A → `92.205.62.239`.